{"id":"MAL-2026-13202","summary":"Malicious code in dwhetlfront-dwhetlfront-core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (fad333b1a33066fabeca9799bee065c5d6431467699a187a25d6ef56a9cbea7f)\nOn require() of the package, index.js loads _support.js which selects a platform-specific payload URL, downloads bytes from Cloudflare workers.dev hosts (oob-worker.cf10{0-3}-*.workers.dev) with a DNS-TXT chunked-base64 fallback under {sdk,ext,pkg,net}.dl.wel1.ru, writes the bytes to /tmp or %TEMP% under a cover-story filename (dotnet_diag_*.exe,.cache_*), chmods 0755, and spawns the file detached via cp.spawn('/bin/sh', ['-c', path + ' &'], {detached:true}) or spawn('cmd',...). Destination hostnames are reconstructed at runtime via array-join splits (e.g., ['sdk','.d','l.wel1','.r','u'].join('') and ['oob-w','orker.cf100-416.worker','s.','dev'].join('')) and API names such as 'child_' + 'process' are string-concatenated to evade static analysis. A lock file gates repeat execution and an opt-out env var serves as a cover story. A parallel dropper implementation exists in lib/telemetry.js (base64 chunk assembly, sh -c spawn, chmod 755 via bracketed 'chmod'+'Sync'); it is not reached from index.js in this version but is bundled in the tarball.\n","modified":"2026-08-05T15:53:10.992607860Z","published":"2026-08-05T15:06:54Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015572","import_time":"2026-08-05T15:19:58.509670185Z","modified_time":"2026-08-05T15:06:54Z","sha256":"fad333b1a33066fabeca9799bee065c5d6431467699a187a25d6ef56a9cbea7f","source":"amazon-inspector","versions":["35.8.1"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dwhetlfront-dwhetlfront-core/v/35.8.1"}],"affected":[{"package":{"name":"dwhetlfront-dwhetlfront-core","ecosystem":"npm","purl":"pkg:npm/dwhetlfront-dwhetlfront-core"},"versions":["35.8.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dwhetlfront-dwhetlfront-core/MAL-2026-13202.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"path":"_support.js","sha256":"9d64e537687cabb5e1c54126cbb9a54be8dba37ffd4741c382375bb793fa2526","tlsh":"f1a1949a15aa70194bb0d7e4871b4416f65ae6a333c0c2d8fb5ca5985f7702483b2efc"},{"path":"lib/telemetry.js","sha256":"a9a802645c10877135f861b205e9d410c26319760a961e544e7694c3bc8b9b18","tlsh":"a9835055566a642186b2b368df234007ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"dwhetlfront-dwhetlfront-core-35.8.1.tgz","hashes":{"sha1":"ef3ef18f75d401caaa187675c827f4a39cb8cb7e","sha512_sri":"sha512-ul/5jNVJacWfY8bMH9CdQLW6i3N4akEId5ITKWfynywv04GBIOm8b1rqLvVeSbxUUXdHg2Q4ugrLA8biM8Qmmw=="}}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}